30 March 2020

few comments on the secured 50-75Bd/850 FSK transmissions

Just to spend a bit of time during this ugly period, I thought I'd take a look at the naval BRASS systems (1) that use the 50Bd/850 and 75Bd/850 (STANAG-4481F) FSK waveforms as well as the  crypto devices that are used in those transmissions. 
A necessary introduction, to not forget, concerns the use of the terms KG-84 and KW-46: well, it does not necessarily mean that those devices are physically deployed ashore or aboard. Rather than to the equipments, these names must be understood as referring to the used "algorithms", since - unless few exceptions - many of those devices are now obsolete and no longer used. Actually, the algorithms are emulated by interoperable and more compact devices such as, for example, the KIV-7M Programmable Multi-Channel Encryptor that can be used for communicating with the older KG-84/KIV-7 family of devices. So, I talk about

- KG-84: when is detected the presence of the 64-bit frame sync
followed by the 128-bit message indicator;

- KW-46: when is is detected the presence of the Fibonacci's bits generated by the polinomyal
x^31 + x^3 +1 (KW-46T uses that M-sequences to synch the KW-46R receive devices).

Using KiwiSDRs located in various parts of the world, and with some lists of logs from UDXF friends, I spent some days browsing the HF spectrum, recording and analyzing as many 50-75Bd/850 FSK transmissions as possible (so far I have come up to 51 different FSK channels), and logging the results into a spreadsheet. By the way, I added the "false 75Bd" frequencies (see this post) to the group of the 50Bd FSK.
Beyond that the "working" list of frequencies is certainly not complete, a fact appears to emerge quite clearly: all the 50Bd/850 FSK transmissions use KW-46 encryption while all the 75Bd/850 FSK use KG-84/KIV-7 encryption!

Fig. 1
(French Navy 50Bd/850 FSK is a separate discussion: they use a 21-bit period stream consisting of frames which are delimited by two LFSR markers M1 M2 generated by the polynomials x^6+x^5+1 and x^7+x^6+1 and a logical "1" value bit; these transmissions were not considered here).

Given that KW-46 is used to secure the fleet broadcasts and KG-84 is used to secure Point-To-Point  (PTP) circuits and multi-station nets [1], it follows that 50Bd/850 FSK is used for broadcast.
For what concerns the 75Bd/850 FSK transmissions, they consist of a continuous  flow of short/long messages; thus, since by their nature  PTP and MRL (2) transmissions are sporadic  and short-lived, 75Bd/850 FSK is used for a "some type of broadcast" for those unspecified multi-station nets. In this regards, it's to notice that some stations may operate simultaneously with the two waveforms, as for example NPN Lualualei (Hawaii, US) which has been heard on 9075 KHz (75Bd) and 9112 KHz (50Bd), thus serving  two different scopes at the same time (Fig. 2).

Fig. 2
It's also to notice that different baud rates and encryption devices were used for GENSER (General Service) traffic and for CRITICOMM (operational intelligence) traffic, but that information is from old non-classified documents from 50 years ago.
I've not clear in mind what "multi-station net" stand for neither if they still refer to naval communications (it could also be that 75Bd just repeate the 50Bd broadcast). The FSK hunt continues...

(1) BRASS (Broadcast and Ship to Shore) is an approach used by Navies, particularly in NATO countries, to communicate between Ships and Shore using HF Radio. The core of a BRASS service is a continuous HF broadcast going out to multiple ships and on several frequencies (typically four or five) to allow ships to select a frequency that works.

(2) The BRASS service makes use of three types of point to point link:
- Ship to Shore. A special link that supports message flow from a ship to shore and request to re-send missing or corrupt messages. Frequency Assignment Broadcast (FAB) is used to allow ships to share a pool of HF frequencies for ship to shore communication.
- Ship to Ship: to support direct communications between ships.
- Maritime Rear Link (MRL).  A link between selected ships (usually "Command Afloat") and shore, supporting message flow in both directions.

15 March 2020

Again about the STANAG-4481F transmissions from NRTF Niscemi

(cryptomaster, I56578. KarapuZ)

STANAG-4481F on 18370 KHz from NPN US Navy, Guam
This is an update and just some remarks to a previous post post which I reference for background. All frequencies are CF (tuning + 2k).

1) the signal

Discussing the signal together, my friend cryptomaster had the suspect that a 50 bps data flow is transmitted using a device which is designed to transmit only with a speed of 75 bps: it could be correct.  The ratio 75/50 is equal to 1.5 thus each "original" bit is repeated 1.5 times. The bit editors work with an integer number of bits (they can't represent half bit) thus the 1.5 bit view is possible only by aggregating two consecutive frames and then getting an integer number of 3 consecutive bits (i.e. 1.5 x 2): thus the 3-bit structure that we see (it's the same of the async 5N1.5 framing which is represented as a 15-bit pattern, i.e. 7.5 x 2). Therefore the bits of the stream are allocated as follows:

A S-4481F transmission lasting 10 seconds produces 750 bits that can be arranged into a 3 x 250 bits pattern; by removing one column we get 2 x 250 = 500 bits that just match a 50bps transmission of the same duration (10 seconds).
But what about the M-sequence generated by the polynomial x^31+x^3+1 ? Notice that the Wagner(13,12) coding, which is used for example in STANAG-5065, replaces each second Fibonacci bit with the parity bit: well, the new Fibocaccci sequence bits (the half of the original one!) still belongs to the same polynomial x^31+x^3+1 (see this post).
Indeed, filtering out the replicated third bits from a 75bps demodulated stream from NSY Niscemi and resizing the resulting stream into a 7-bit pattern, it turns out that we get an usual KW-46 encrypted 7-bit stream (Fig. 1).

Fig. 1
In the light of the above, I analyzed again the signals in order to verify what we hypothesized and found above. I compared a signal from NSY Niscemi recorded on 6383 KHz (3-bit pattern S-4481F) and another one from NAU Isabela 12120 KHz (plain S-4481F) by using the the modified quadrature amplitude detector of SA software: you can valuate the different results (Fig. 2).

Fig. 2
Even more interesting: all the signals from Niscemi show the extra harmonics EXCEPT the signal on 6942 KHz which is correctly modulated (Fig. 3) and coincidentally does not has the 3-bit pattern (Fig. 8).

Fig. 3
Then I selected the 50 Hz clock from the NSY signal and subsequently I demodulate it by using the synch'ed FSK demodulator: the test was successful and replicated the same results that I found using the theory and manipulating the bitstreams (Fig. 4). So, 50 bps seems to be the right working speed.

If our analysis is correct and we are right, it seems that they use the 75 bps STANAG-4481F waveform to send 50 bps streams (?!). We do not know the reason but probably you can  do this. In synchronous transmissions the DTE usually provides the transmit clock to the modem but perhaps they could use a modem - e.g. like the Harris RF-5710A - which can recover the clock automatically from the incoming transmit data (transmit clock set to "DATA" or in "recovery mode").

As proved, decoding those signals using standards modes, or changing the speeds to 50 bps, unfortunately does not work: the only successful way is to sync the FSK demodulator to the 50 Hz clock of the signals. Since we are talking about shore-to-ship broadcast, I wonder how the receive ships may manage these transmissions.

2) the source

(monitoring was carried out according to a list of frequencies from logs and in any case not 24/7)

a) Using remote KiwiSDRs, and with the help of my friend Mike "mco", I checked several S-4481F transmissions from AJE Barford St.John, NAU Isabela, NPG Dixon, NPM Lualualei, NPN Guam, NSY Niscemi, and NSS Davidsonville but - so far - only those from NSY and AJE exhibit the odd 3-bit pattern we are talking about. Despite many attempts, still not heard S-4481F transmissions from Totsuka and San Diego and I'm not aware of such transmissions from Diego Garcia (50Bd/850 only?) or any other station.
Below the current list of the successful frequencies:

5120.5 NSY
6383.0 NSY
7545.5 NSY
8145.0 NSY, AJE
8204.5 NSY

It's to notice that most of the times the NSY frequencies are logged as "NSY Sigonella": well, NAVCOMTELSTA (U.S. NAVAL COMPUTER AND TELECOMMUNICATIONS STATION) Sicily, located in Naval Air Station Sigonella, manages the Naval Radio Transmitter Facility Niscemi, housing LF/HF transmitters [1][2]. Same story about AJE Barford St.John that probably is sometimes reported as Croughton, nearby (6 miles distant) [3][4]. 

b) Interestingly, 8145 KHz is shared by NSY and AJE; often I have been able to see contemporary broadcasts and same contents (Figs 5,6). The modified AM detector shows the same results as the ones of Fig. 3

The modified AM detector shows the same results as the ones of Fig. 3:

Fig. 7

 c) According to the Tx sites (NSY in Italy and AJE in UK) this type of traffic is beamed only by some European stations. 

d) As said above, I also spotted a S-4481F transmission on 6942 KHz that DF points to southern Sicily, thus it's again NSY. However, this signal does not have the expected 3-bit structure although it's contemporaneous to another S-4481F transmission beamed from NSY on 6383 Khz (Figs 8,9). So, it seems that most of the 3-bit structured signals come from NSY,  but not all those coming from NSY have that feature. Still not heard S-4881F transmissions on the other NSY frequencies 10974 and 15018 KHz.



28 February 2020

Makhovik secured CIS PSK2/1200Bd

This post is an update and a correction to a previous post to which reference. I want to thank an anonymous reader who in his comment to that post suggested to use differential PSK2 decoding.
In that post I verified the use of Makhovik crypto system (T-230 bundle ciphering device for teleprinter and data connections) in CIS-12 transmissions as well as in CIS PSK2/1200Bd (CIS-1200) transmissions. One of Makhovik's features that can be considered as a signature, in addition to the characteristic 30-bit Message Indicators, is the use of 511-bit pseudo-random sequences generated by the primitive polynomial x^9+x^5+1. These sequences follow the ITU Recommendation O.153 [1] and are primarily intended for error measurements at bitrates up to 14400bps  and synchronization purposes (188-110B "39-tone parallel mode" too uses that pattern).
I searched just these 511-bit sequences in three different CIS-1200 recordings (files psk2_a, psk2_b, and psk2_c) and the search was successful in all the three files but I did not find the right sequences, and then the generator polynomial x^9+x^5+1, in the _a recording (Fig. 1).

Fig. 1
As said above, an anonymous reader suggested to use differential decoding for the _a file: well, I took his advice and results are interesting: as shown in Fig. 2, after the differential decoding the bitstream have the right 511-bit sequences generated by the polynomial x^9+x^5+1 !

Fig. 2 - psk2_a diff. decoded bitstream
This is a further indication in favor of the use of  Makovik encryption with the CIS-1200 waveform,  in these cases the modem T-230-1A (a single channel version of T-230) should have been used. 
As usual, further recordings are needed.

24 February 2020

3 x 7-bit KW-46 secured channels over STANAG-4481F, NRTF Niscemi

(cryptomaster, I56578, KarapuZ)

This post may be considered as a continuation of an interesting analysis started by my friends cryptomaster and  KarapuZ, see the radioscanner post for background. The signals analyzed by my friends and me consist of STANAG-4481F waveform (also known as NATO-75, FSK 75Bd/850) and  have been spotted on 8202.5 KHz/usb (tuning frequency, CF = +2000 Hz): in our opinion they seem to be (off line) fleet broadcasts of 3 x 7-bit multiplexed encrypted channels.
I want to thank my friend AngazU and the owner of the KiwiSDR in Alicante (Spain) who allowed me to use his device w/out time limits in order to monitor these transmissions.

The interesting aspect is the 3-bit structure which is visible in SA raster (Fig. 1) by using, for example, a time window of 200ms (=15 bits @75bps); notice that it does not occur in time windows that implie a number of bits which is not an integer multiple of 3.

Fig. 1 - 3-bit structure in a 200ms raster window
Following this results, the demodulated stream has been reshaped into a 3-bit framing (Fig. 2): it is easy to see that two columns have the same content.

Fig. 2 - 3-bit framing of the demodulated stream
Then, each column in turn has been reshaped in a 7-bit pattern in order to obtain 3 separate files corresponding to the three channels. Karapuz noted that the Fibonacci's bit sequence (generated by the polynomial x^31 + x^3 + 1) is present in each channel (Fig. 3): this is the main indication that the source data was encrypted using the KW-46/KIV-7 cryptographic device, according to STANAG -5065.

Fig. 3 - the KW-46 M-sequences in the 3 channels conveyed by a single S-4481F trasnmission
The presence of three distinct channels suggests that a time division multiplexer (TDM) be used upstream of the S-4481F modem, but there is a problem with the speeds at stake. The used TDM must have a 75bps "aggregate" speed in order to meet the S-4481F waveform requirements, thus each (encrypted!) input channel should have a speed of 25bps... but crypto devices such as KG-46 or KIV-7 do not work at speeds lower than 50 bps! (Fig. 4).

Fig. 4
So, it seems that a kind of "rate change" occurs between TDM and S-4481F modem but a such kind of store-and-forward device to down the speed  appears unrealistic in case of long broadcasts.

During my monitoring I had the luck to catch the beginning of a transmission. Interestingly, the M-sequences generated by the polynomial x^31 + x^3 + 1 just start from the very first bit of the 3 demodulated streams (100% indication in Fig. 5), there are no signatures or magic numbers attributable to transfer protocols or to file formats, neither preambles or synch sequences.

Fig. 5
According to TDoA direction finding tries, the transmitter site is the Naval Radio Transmitter Facility (NRTF) in Niscemi, Italy (Fig. 6): an infrastructure of the NATO communication system that is linked with other US military bases [1]. It's to notice that similar transmissions (3-bit structure S-4481F) can be heard on 7545.5 and 6383 KHz (CF), also them from NRTF Niscemi!

Fig. 6 - TDoA result
As I said, two channels have the same content, as indeed shown in the raster (Fig. 1): it's to notice that such repetitions of encrypted channels were also noted in some KW-46/KIV-7M secured fleet broadcast of the Australian Ny, see the blog post. In that case we have an aggregate speed of 600bps and 12 multiplexed channels, i.e. 50bps speed per channel.

I checked sveral other S-4481F transmissions but so far these odd 3-bit structure is present only in the ones coming from Niscemi: help and comments from readers are very apreciated and welcome.

High Frequency dual mode antennas at NRTF Niscemi (source Wikipedia)
24 Feb update
As expected, parallel transmissions on 8204.5 KHz and 6383 KHz convey the same content (Fig. 7); the third frequency (7545.5 KHz) is not used at this time. 

Fig. 7 - same contents on parallel transmissions

  (to be continued)
[1] https://www.globalsecurity.org/military/facility/niscemi.htm 

12 February 2020

Interesting MS-110D App.D (WBHF) traffic

Interesting traffic heard on 5750 KHz/USB and picked up thanks to the UK KiwiSDR owned by G8JNJ.
Most of the signals are definitely "110C Appendix D" 3 KHz BW waveform (WID 1 or 2, BPSK). The synchronization preamble has a framing of ~240ms length that makes 576 symbols @2400Bd speed (Fig. 1). From 188-110C App.D documentation, the orthogonal Walsh modulation is used in the synchronization section of the preamble and the length of the repeated super-frame is 18 channel-symbols, ie: 9 (fixed) + 4 (downcount) + 5 (waveform identification). Since in 3 KHz bandwidth waveforms the preamble channel-symbols are 32 symbol long, the length of each repeated superframe is: 18 (channel-symbols) x 32 (length of one channel-symbol) that just matches the measured 576 symbols length.
Data section has 40ms length frames (Fig. 2) i.e. each frame consists of 96 symbols: 48 unknown data + 48 known data (mini-probe). This framing meet the waveform IDs 1 and 2 of the 3KHz bandwidth set (BPSK modulated data).

Fig. 1 - Synchronization preamble superframes
Fig.2 - data section frames
Anyway, FLSU BW5 bursts and unid 2400Bd bursts are the most interesting aspects in this catch.
In my opinion the presence of (repeated) 3G-HF Fast Link SetUp (FLSU) BW5 bursts is rather strange also because the link seems to be terminated with a 188-141A 2G-ALE "TWS" sequence: a kind of "fall back" for 2G-ALE? Perhaps we're dealing with a STANAG-4538 "circuit-mode" service and I did not hear the BW5 PDUs sent by the other side of  the link, or perhaps BW5 PDUs are just used to signal the following traffic waveform.
The other 2400Bd bursts (Fig. 3) have a fixed duration of ~2840ms: unfortunately the poor SNR of the signals does not allow to get other significant parameters from their analysis.

Fig. 3
As said, the link was terminated using 2G-ALE: the TWS message was sent by the ALE callsign "AC7", It's to be noticed that during the monitoring period other ALE soundings from calls "AC7" and "AC9"  have been heard. According to recent UDXF logs, these calls refer to a unid Jordan network, although it sounds weird to me that they use WBHF technology. Maybe some WBHF trials... but it's just a guess.


4 February 2020

Israeli Navy running their proprietary PSK serial tone with Tadiran/Elbit DCS (Digital-Coded Squelch)

Reading radioscanner.ru I found an interesting post my friend Cryptomaster about Israeli Defense Force (IDF) Navy transmissions consisting of their proprietary PSK serial tone waveform sent along with the Tadiran/Elbit Digital Coded Squelch (DCS) signal activated. Since the Istraeli Ny transmissions are quite frequent and easy to receive and recognize, I decided to take a look at the frequency reported by Cryptomaster (13372.0 Khz/USB): the transmissions were picked up using the Italian KiwiSDR owned by IZ6BYY.

The DCS signal is sent continuously, starting when transmission begins, and transmitted on a frequency which is slightly higher than the one used by the data signal (i.e. "over" the data signal) by using an FSK waveform wich is modulated at the rate of 125 bit/sec and 290 Hz shifted (Fig. 1).

Fig. 1
Tadiran/Elbit DCS implementation is a 84 bit long string, while standard DCS [1] codewords consist of 23 bit long string (10 bit data + 3 fixed bits + 11 check bits): don't know if a similar framing is used here. Anyway, notice that at the end of each transmission the encoder changes the code to a pattern consisting of the same string sent in opposite polarity: most likely it's a "turn off" code that causes receiving decoders to mute (Fig. 2) and to signal the end of the data transmission.

Fig. 2 - Tadiran/Elbit DCS bitstream
Radios with DCS options are generally compatible, provided the radio's encoder-decoder will use the same code as radios in the existing network. indeed, the use of DCS has only been noted on this frequency: Fig. 3 shows contemporary transmissions on 13372 and 8070 KHz/USB. Notice that the two signals occupy the same bandwidth: it may be that before DCS were applied the PSK signal is subjected to a tighter filtering.

Fig. 3 - Isr-Ny contemporary transmissions
DCS support could be provided by Tadiran/Elbit devices such as the HF-6000 or HF-8000 [2]: I already met that signal coupled with the Nokia msg terminal.
Since a compatible radio ignores signals that do not include a bitstream with the specified code, DCS could also be used as a type of selective calling. Indeed, the Tadiran "Selective Calling" feature (that's not ALE) just uses an FSK waveform as DCS: perhaps the DCS words "open" the squelch of the addressed radios (all, group, individual) but it's only a my guess...

Fig. 4

25 January 2020

Unid FSK 35.5Bd/1000

Unid FSK 35.5Bd/1000 heard in idling mode on 10550 KHz (CF) and recorded using the KiwiSDR located in Kuopio, Finland.
The raster shows a distortion of the manipulation speed which is also visible in the phase detector (Fig. 2): most likely a native defect of the source modem/transmitter.

Fig. 1
Fig. 2
Although quite uncommon, the baud rate is 35.5 Bd, as shown in Figure 3 where I isolated and analyzed a "clean" signal segment. It's the first time for me I meet such speed in a FSK waveform (only in CIS-60 HDR modem) but it must be said that there is a possibility that the speed will change when switching from idle to traffic mode (as the old BEE 36/50 did), unfortunately during my listening the signal remained in idle mode.

Fig. 3
As for the source of the signal, it is reasonable to think of a Russian user since the shift of 1000 Hz is used in waveforms such as CIS-14, Vezha-S and also Akula as well as used by Rus-AF (1). Nevertheless, Indian Navy too (VTH9) uses 1000 Hz shift in their FSK 50Bd transmissions.  
Although I have been keeping an eye on that frequency, to date I have not yet had the opportunity to hear this signal again.


(1) REA4 Moscow AF HQ  uses FSK 50Bd/1000 in idling between skeds in FSK Morse (5FGs).

22 January 2020

SkyOFDM 28-tone 86Hz 65.6Bd PSK2 (2)

Just for background it might be helpful to read the previous post.

Most likely the signal that is continuously transmitted on 4150 KHz/usb is a modded or a new waveform of the Skysweep Technologies proprietary "SkyOFDM" family. SkyOFDM is a high speed modem based on the OFDM and turbo coding technologies.  It offers several baud  rates (300-9600  bps) and two different interleaving options (short and long). Also there are two bandwidth options: 2000Hz (OFDM 22 tones) and 2400 Hz (OFDM 28 tones).

Fig. 1 - SkySweeper running the SkyOFDM modem
I tried the SkyOFDM modes available in SkySweeper 5.13 (Fig. 1), a Windows based product for radio data decoding and signal analysis developed by SkySweep.  As expected, I could not synthesize the exact waveform running on 4158 KHz since the different speeds, modulations, and ACF:

params SkyOFDM 4150 Hz OFDM
bandwidth (Hz) 2000, 2400 2400
preamble 7 tones 7 tones
tones 22, 28 28
shift (Hz) 86 86
Baud rate 60.56, 64, 79 65.57x
modulations PSK2, PSK4, QAM PSK2/SDPSKx
ACF (ms) 78, 113.4 76.2x

A peculiar difference lies in the type of the used modulations: for example, if you filter out and look at the modulation used in the second channel, you will see that is not PSK2 but SDPSK (Simmetric Differential PSK), thus it seems that channels are mixed artfully (Fig. 2 ).

Fig. 2
In SA Phase-Plane using n-Ary = 4 and absolute mode (diff=0) the transitions between states are similar to QPSK but without diagonal paths; in differential mode (diff=1) we see transitions between two states (Fig. 3) (1).

Fig. 3
According to some utility DXers, SkyOFDM waveforms were used by Finnish MFA and that's correct since SkySweep Technologies is a Finnish high tech company. Although there are still many references in the web to SkySweep, their official website is no longer online: this suggests a ceased activity or an incorporation into another company. Indeed, looking at waybackmachine.com, the site skysweep.com was crawled last time on 13 June 2017; by the way, SkySweeper software was discontinued on June 1st 2009.
That said, the permanence of this signal on 4150 KHz and its purpose are still unknown to me as well as other friends.

(1) PSK encodes the input data sequences in pahes (states), while Differential PSK (DPSK) encodes the input data in the phase difference (transitions) between successive bits or symbols. This means that there would be a phase change in the modulation signal if the two successive bits in the input data sequence are different (0 to 1 or 1 to 0), and no phase changes if the successive bits are the same. DPSK is called conventional DPSK (or CDPSK) if the phase differences is in the set of [0,π] and symmetrical DPSK (SDPSK, also called π/2-DPSK) if the phase difference is in the set of [π/2,-π/2]. As you see in Fig. 3 the transitions in differential mode (diff=1) are in the set of [π/2,-π/2] so most likely it's a SDPSK (π/2-DPSK). 

18 January 2020

unid SkyOFDM 28-tone 86Hz 65.6Bd PSK2

Continuous ofdm bursts transmission picked up on 4158 KHz/USB thanks to the "ArcticSDR" in Kongsfjord Arctic Norway: a KiwiSDR managed by my friend Bjarne Mjelde

Timings of the transmission and its spectrum are shown in Fig. 1 

Fig. 1 - timing and spectrum
The analysis of the OFDM signal clearly shows 28 channels and a frequency spacing of ~86 Hz, each channel is modulated using PSK2 at the symbol rate of 65.57 Bd (Fig. 2). The same results are obtained/verified by analyzing a single channel as shown in Fig. 3 (higher channel).
Fig. 2 - OFDM analysis
Fig. 3 - anlysis of the higher channel (#28)
As you see in Fig. 2, I did a further analysis after resampling the signal at 10109 Hz. Indeed, I used the tool OCG [1] in order to calculate and sythesize an OFDM waveform having the same parameters (channels, Br, Shift, modulation, width,...) and got 10109 Hz as one of the possible "native" sampling rate. The analysis of the synthesized OFDM is visible in fig. 4: notice the similarity between the PSK2 constellation of the synthesized signal and the one of the real signal (although resampled).

Fig. 4 - analysis of the synthesized OFdM-28 signal
The seven initial tones last 30 symbol periods and are derived from the OFDM generator as shown in Fig. 5; more precisely the used tones are: 2, 5, 6, 9, 13, 16, and 19.

Fig. 5 - initial seven unmodulated tones
The autocorrelation has a value of 76.2 ms (Fig. 6) that makes a 140 symbols length frame if considering an aggregate speed of ~1836 Bd (65.57 x 28).

Fig. 6 - autocorrelation
A similar OFDM waveform but with shorter and different bursts (Fig. 7) was reported on 2016.02.05 by my friend Cryptomaster [2] just on the same frequency of 4158 KHz/USB. In that case the modulation used was a form of PSK4, anyway number of tones, shift, Br, and ACF are the same; thus, that signal is on-air since several years.

Fig. 7
As regards the signal source, several TDoA tries always indicated an area north to Helsinki as probable Tx site (Fig. 8) although qrg.globaltuners.com reports exactly the same waveform/spectrum (and frequency too) indicating it as a signal sourced by the Spanish Navy [3].  In my opinion that's quite odd since the signal is fairly well received in the northern European countries such as Sweden, Norway, and Finland, while it is rather weak or inaudible at all in south Europe... I don't think of such a long skip.

Fig. 8 - TDoA reults

In my opinion it's an evolution of the original Skysweep Technologies proprietary waveform named "SkyOFDM", probably used by Finnish MFA (thanks to Roland Proesch for the hint). Indeed, the mentioned recording by my friend Cryptomaster just matches the features of the "original" SkyOFDM waveform (Fig. 9).

Fig. 9 - Skysweep Technologies OFDM-28

It's worth noting that SkySweeper Pro 5.13 software does not recognize the "new" OFDM-28 PSK2 that is analyzed  in this post.
(to be continued)


[1] OCG is a program for calculating and synthesizing OFDM signals, it can be downloaded from here
[2] http://www.radioscanner.ru/files/unknown/file19060/
[3] http://qrg.globaltuners.com/details.php?id=17420

13 January 2020

COMSEC transmissions using a S4285 variant (2)

Secured burst transmission using a modified S4285 waveform [1] spotted around midnight on 4015 KHz/usb, the S4285 mode is 600bps and short interleaver. 

Fig. 1
After demodulation, the COMSEC preamble resembles 188-220D std and consists of 3 parts (my guess):
1) 60-bit Frame Sync (110000100000111000101111001011011101101001001011111010101100)
2) 5 x 128-bit strings, encoded Message Indicator (five times repeated)
3) 64-bit idling sequence (time to load the key?)

Preamble is followed by the encrypted data block which ends with "01" sequences.
Fig. 2 - demodulated stream of bursts

Fig. 3 - COMSEC preamble (my guess)

https://yadi.sk/d/nY-DTuTz-ZWG8g  (2020-01-10T005300Z, 4.015 MHz, USB.wav)
https://yadi.sk/d/oIHVEWbUO0_few   (2020-01-10T010336Z, 4.015 MHz, USB.bin)

[1] The same modified S4285 waveform was met here on 6931 KHz/usb: